|Publication number||US7373517 B1|
|Application number||US 09/378,226|
|Publication date||May 13, 2008|
|Filing date||Aug 19, 1999|
|Priority date||Aug 19, 1999|
|Also published as||WO2001013572A1|
|Publication number||09378226, 378226, US 7373517 B1, US 7373517B1, US-B1-7373517, US7373517 B1, US7373517B1|
|Inventors||Mark D. Riggins|
|Original Assignee||Visto Corporation|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (66), Non-Patent Citations (18), Referenced by (72), Classifications (21), Legal Events (9)|
|External Links: USPTO, USPTO Assignment, Espacenet|
1. Field of the Invention
This invention relates generally to computer networks, and more particularly to a system and method for encrypting and decrypting files to enable secure exchange of information in a computer network.
2. Background Art
In its infancy, the Internet provided a research-oriented environment where users and hosts were interested in a free and open exchange of information, and where users and hosts mutually trusted one another. However, the Internet has grown drastically, currently interconnecting at least 100,000 computer networks and millions of users. Because of its size and openness, the Internet has become a target of data theft, data alteration and other mischief.
Virtually everyone that sends information over the Internet is vulnerable. Before sending a file, companies balance the benefits and ease of transferring a file over the Internet against the risks of potential unauthorized file access.
One of the most popular of current security techniques is private key file encryption and decryption. A file may be encrypted and decrypted using a private key known to all authorized users. Thus, a file may be encrypted using the private key, forwarded over a computer network, and decrypted using the private key by the end user. Accordingly, both the encrypting party and the decrypting party must know the private key.
This encryption and decryption security technique does not solve problems and concerns of the roaming user. First, for example, a roaming user must maintain a portable record of all private keys so that he or she can decrypt or re-encrypt files. Maintaining a portable record can be a time consuming and cumbersome process. Therefore, a system and method for encrypting and decrypting files is needed to facilitate remote access to information resources in a computer network easily and securely (without sending keys over the network).
The present invention provides a system and method for encrypting and decrypting files to enable secure access to information resources in a computer network. The system and method distribute the task of decryption between a server and a client, thereby adding to the level of security. The system and method provide recognizable benefits in a network having a trusted client (which performs the encryption), a server (which stores the encrypted data and a hint), and an untrusted client (where the user is currently operating). Decryption may be performed at the server or at the untrusted client, without transferring the key or a password over the network.
To encrypt data, the trusted client generates an encryption/decryption key. That is, a user interface obtains a password, generally from a user. A hint generator generates a hint, preferably, a pseudo-random number. A key generator generates a key based on the password and on the hint. In a more secure, but more complex, embodiment enabling server-side or client-side decryption, the key equals H(H(H(P)), H(H(P), hint)). Namely, a key generator hashes the password to generate a first secret, hashes the first secret to generate a second secret, hashes the first secret with the hint to generate an intermediate index, and hashes the second secret and the intermediate index to generate the key. In a simpler, but less secure, embodiment facilitating client-side decryption, the key equals H(P, hint). Namely, a user interface obtains a password and a hint generator generates a hint. Then, a key generator hashes the password and the hint to generate the key. An encryption engine can then use the key to encrypt data. The client sends the encrypted data and the hint for storage on the server. Alternatively, the global server can generate and store the same hint independently.
To decrypt encrypted data, the key must first be determined. To generate the key, the server knows some information and the user knows some information. For data encrypted using the more secure encryption embodiment, client-side and server-side decryption are each possible.
In the client-side decryption case, a user interface obtains the password from the user. A communications engine retrieves the hint from the server. An index generator hashes the password to generate the first secret, and hashes the hint and the first secret to generate the intermediate index. A key generator hashes the first secret to generate the second secret, and hashes the second secret and the intermediate index to generate the key. In the server-side decryption case, the communications engine forwards the intermediate index to the server. The server, which for this embodiment preferably learned the second secret during account setup, hashes the second secret and the intermediate index to generate the key. It will be appreciated that, because the server does not know the password or the first secret (which is only derivable knowing the password), the server alone cannot compute the key.
For data encrypted using the simpler encryption embodiment, the remote client generates the key. A user interface obtains a password from the user. A communications engine retrieves the hint and encrypted data from the server. A key generator hashes the password and the hint to generate the key. It will be appreciated that any number of hashes can be performed on the variables to compute the key. For example, the password may be hashed to compute a secret, and the secret and key may be hashed to compute the key.
A first system in accordance with the present invention includes a user interface for obtaining a password; a key generator coupled to the user interface for hashing a hint and the password to generate a key; an encryption engine coupled to the key generator for encrypting data using the key; and a communications module coupled to the engine for sending the encrypted data and the hint to a server for storage.
A second system in accordance with the present invention includes an encryption downloadable for deriving an encryption key from a password and a hint; a web server for interfacing with a client, for sending the encryption downloadable to the client, for receiving encrypted data that was encrypted by the encryption downloadable from the client, and for receiving a hint corresponding to the encrypted data and needed to regenerate the key from the client; and memory coupled to the web server for storing the hint and the encrypted data.
A third system in accordance with the present invention includes a user interface for obtaining a password; a communications module for receiving the encrypted data and a hint corresponding to the encrypted from a server; a key generator for hashing the password and the hint to generate a key for decrypting the encrypted data.
A fourth system in accordance with the present invention includes a decryption downloadable for deriving a key from a password and a hint; encrypted data; a hint corresponding to the encrypted data; and a web server for interfacing with a client, and for sending the decryption downloadable, the encrypted data and the hint to the client.
A fifth system in accordance with the present invention includes a user interface for obtaining a password; an index generator coupled to the user interface for generating an intermediate index from a hint received from a server and a secret derived from the password; and a communications engine coupled to the index generator for sending the intermediate index to the server.
A sixth system in accordance with the present invention includes a second secret corresponding to a user; a decryption downloadable for generating an intermediate index from a password and a hint; a web server for receiving an indication of encrypted data to be decrypted, for transmitting the decryption downloadable and a hint corresponding to the indication to a client, and for receiving an intermediate index from the client; and a server-resident module for deriving a key for decrypting the encrypted data from the second secret and the intermediate index.
One of ordinary skill will recognize that the key is never transmitted over computer network. It will be further appreciated that the password is never transmitted over the internet. Thus, even if a hacker somehow obtained the password, the hacker could not generate the key without obtaining the proper hash functions and hint corresponding to the data from the server (which requires proper identification and authentication). It will be further appreciated that, for server-side decryption in the more secure embodiment, the second secret is transmitted only once across the network, preferably, at account setup. The second secret, along with the first secret and the hint, are needed at a later time to generate the key. Thus, it would be practically impossible for a hacker to obtain all the information needed to generate the key.
It will be even further appreciated that, by distributing parts of the decryption function to the remote client and parts to the server, it is not possible for either site alone to decrypt data without acquiring additional information from the other site. One of ordinary skill will understand that by distributing the decryption function between the remote client and server (referred to as double indirection), it is not possible for the global server to decrypt the file without acquiring additional information from the remote client and vice versa. Hence, one of ordinary skill will understand that an unauthorized capture of information during network transfer will fail to provide enough information to decrypt encrypted data. Therefore, the system and method provide a heightened level of data security.
The following description illustrates general and specific principles of the invention and is not to be considered limiting.
The global server 105 includes a computer system that has an encryption downloadable 123, a client decryption downloadable 125, a server decryption module 130, a user database 135 and a web server 175. The user database 135 includes encrypted data 140, hints 145 and second secrets 150. It will be appreciated that global server 105 may also include security services (not shown) for performing identification and authentication services to confirm user access privileges.
The local client 115 includes a computer system that has a browser 165 and unencrypted data 170. The remote client 120 includes a computer system that has a browser 155 and a data program 160 for viewing the unencrypted (or decrypted) data 170. The local client 115 may be a “trusted” client, and the remote client 120 may be an “untrusted” client. It will be appreciated that the difference between the remote client 120 and the local client 115 is merely that the user operates the local client 115 to encrypt data 170 and the user operates the remote client 120 to request decryption of the data 140. The remote client 120 and local client 115 may be the same computer. The term “browser” is being used herein to include any engine for communicating in a network environment, possibly using File Transfer Protocol (FTP), HyperText Transfer Protocol (HTTP) and HyperText Markup Language (HTML). It will be appreciated that local client 115 or remote client 120 may include a smart telephone, a Personal Data Assistant (PDA) such as the Palm III™ system by the U.S. Robotics, Inc., a laptop computer, etc. Although not shown, one skilled in the art will recognize that the local client 115 may also include an instance of the data program 160. Those skilled in the art will recognize that the data program 160 may be a data processing program, an e-mail program, a network browser, a calendar program or another type of processing engine. Accordingly, the unencrypted data 170 may include files, e-mail, bookmarks, calendar information or other type of data.
The encryption downloadable 123 enables the local client 115 to encrypt the unencrypted data 170 and to store the encrypted data 140 on the global server 105. A first method of encryption is discussed with reference to
Accordingly, to decrypt the encrypted data 140, the hint 145 and two secrets associated with the encrypted data 140 must be determined. To enable client-side decryption of encrypted data 140, the encryption downloadable 123 stores the hint 145 on the global server 105. To enable server-side decryption of the encrypted data 140, the encryption downloadable 123 stores the hint 145 and the second secret 150 on the global server 115. These two methods of decryption are described with reference to
Other techniques of encryption and decryption, which allow a client site 115/120 to maintain some information and the server 105 to maintain other information for decrypting data 140, are also possible in light of the teachings herein. For example, in a simpler but less secure embodiment that facilitates client-side decryption (described in greater detail with reference to
The client decryption downloadable 125 performs client-side decryption, and is described with reference to
The server decryption module 130 performs server-side decryption, and is described with reference to
It will be appreciated that the second secret may have been stored on the global server 105 during the setup of the original account. That is, at account setup, a downloadable having secret generation code may have been sent to the user, for example, at the local client 115, who inputs a password. The downloadable then generates the second secret 150 and forwards the second secret 150 to the global server 105. It will be appreciated that the second secret 150 alone is not enough to generate the key, since the intermediate index is not known. It will be appreciated that, for this embodiment, server-side or client-side decryption could be selected based on the security level of the communication channel between the client 120 and server 105, on client terminal type (e.g., processor power), on the size of the file (e.g., the length of time it will take to download the file), or on user preferences. Further, server-side or client-side decryption can be determined at the time of decryption, at the time of encryption, at account setup, or at any other time.
The web server 114 provides web page data and web page functionality to clients, such as to the remote client 116 or to the local client 124. Providing web page functionality and data may include transmitting downloadables such as the encryption downloadable 123 and the client decryption downloadable 125 to the clients.
An operating system 240 controls processing by the processor 205, and is typically stored in data storage 230 and loaded into working memory 235 (as illustrated) for execution. Other programs and data 245 such as browsers, servers, downloadables, unencrypted or encrypted data, etc. may also be stored in data storage 230 and loaded into working memory 235 (as illustrated) for execution by processor 205.
One skilled in the art will recognize that the computer system 200 may also include additional information, such as network connections, additional memory, additional processors, LANs, input/output lines for transferring information across a hardware channel, the Internet or an Intranet, etc. One skilled in the art will also recognize that the programs and data may be received by and stored in the system in alternative ways. For example, a computer-readable storage medium (CRSM) reader 250 such as a floppy disk drive, hard disk drive, CD-ROM reader, magneto-optical reader, CPU (for RAM), etc. may be coupled to the communications channel 220 for reading a computer-readable storage medium (CRSM) 255 such as a magnetic disk, a hard disk, a magneto-optical disk, RAM, etc. Accordingly, the computer system 200 may receive programs and data via the CRSM reader 250.
It will be appreciated that, for client-side decryption, the system may alternatively not generate a secret at all. Alternatively, the system may perform any number of hashes of the variable password and variable hint. For example, the key generator 310 may hash the password and the hint to generate the key. When a request is received for client-side decryption, the client decryption downloadable and hint may be transmitted to the remote client 120. The client decryption downloadable can request the password, and hash the hint and password to generate the key. A hacker obtaining the transmitted hint has insufficient information to generate the key. Two secrets are generated for server-side decryption since the hint and intermediate index must be transmitted across the network 110. A second level of indirection is therefore needed. In either case, the task of decryption is distributed between the global server 105 and remote client 120, and the key is never transmitted across the network 110.
The key generator 530 preferably includes code for hashing the intermediate index and the second secret 150 previously stored on the global server 105 to generate the key. It will be appreciated that the second secret 150 may have been received at account creation, during a previous transaction or, if necessary, during this transaction. The decryption engine 535 is similar to the decryption engine 415 of the client decryption downloadable 125, and includes code for using the key and the decryption algorithm associated with the encryption algorithm performed by the encryption engine 315 to decrypt the encrypted data 140. The remote client communications engine 540 includes any necessary code for sending the decrypted data to the remote client 120, if so requested.
The local client 115 in step 630 executes the encryption downloadable 123, possibly using the applet-enabled browser 165, installation software initiated automatically, ActiveX™ controls, etc., to encrypt data 170. Details of step 630 are described with reference to
The key generator 310 of the encryption downloadable 123 in step 725 instructs the hint generator 325 to generate a hint. The hint generator 325 generates a cryptographically semi-random number, preferably of variable length, and forwards the number to the key generator 310 as the hint. The key generator 310 in step 730 performs a one-way hash using the hint and the first secret to generate an intermediate index. The key generator 310 in step 735 performs a one-way hash function using the intermediate index and the second secret to generate the key. Accordingly, the encryption engine 315 in step 740 encrypts the unencrypted data using the key. Method 630 then ends.
If server-side decryption is selected, then the global server 105 in step 830 executes the decryption algorithm, described in greater detail with reference to
Then, in step 840, the remote client 120 can, for example, access the decrypted data. In another example, the remote client 120 in step 840 can attach the data to an e-mail and transmit the e-mail to another person. In yet another example, the remote client 120 in step 840 can encrypt the data using another person's key, attach the data to an e-mail and transmit the e-mail to another person. It will be appreciated that, in either case where an e-mail is being sent, the global server 105 need not download the decrypted data since the remote client 120 merely transmitting the e-mail and data to another person. The global server 105 can perform these steps on behalf of the remote client 120. Method 800 then ends.
One of ordinary skill will recognize that the key is never transmitted over computer network. It will be further appreciated that the password is never transmitted over the internet. Accordingly, the key cannot be generated. Even if a hacker somehow obtained the password, the key could not be generated without obtaining the proper hash functions and hint corresponding to the data from the global server 105 (which requires proper identification and authentication). It will be further appreciated that the second secret 150 is transmitted only once across the network 110, and needed at the time the data is to be decrypted.
It will be even further appreciated that, by distributing parts of the decryption function to the remote client 120 and parts to the global server 105, it is not possible for either site alone to decrypt data without acquiring additional information from the other site. One of ordinary skill will understand that by distributing the decryption function between the remote client and global server (referred to as double indirection), it is not possible for the global server to decrypt the file without acquiring additional information from the remote client. Hence, one of ordinary skill will understand that an unauthorized capture of information during network transfer will fail to provide enough information to decrypt encrypted data 140. Therefore, the system and method provide a heightened level of data security.
The foregoing description of the preferred embodiments of the present invention is by way of example only, and other variations and modifications of the above-described embodiments and methods are possible in light of the foregoing teaching. Although the network sites are being described as separate and distinct sites, one skilled in the art will recognize that these sites may be a part of an integral site, may each include portions of multiple sites, or may include combinations of single and multiple sites. Further, components of this invention may be implemented using a programmed general purpose digital computer, using application specific integrated circuits, or using a network of interconnected conventional components and circuits. Connections may be wired, wireless, modem, etc. The embodiments described herein are not intended to be exhaustive or limiting. The present invention is limited only by the following claims.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US4652698||Aug 13, 1984||Mar 24, 1987||Ncr Corporation||Method and system for providing system security in a remote terminal environment|
|US4831582||Nov 7, 1986||May 16, 1989||Allen-Bradley Company, Inc.||Database access machine for factory automation network|
|US4897781||Feb 13, 1987||Jan 30, 1990||International Business Machines Corporation||System and method for using cached data at a local node after re-opening a file at a remote node in a distributed networking environment|
|US5048085||Oct 6, 1989||Sep 10, 1991||International Business Machines Corporation||Transaction system security method and apparatus|
|US5218638 *||Dec 5, 1991||Jun 8, 1993||Hitachi Ltd.||Encipher method and decipher method|
|US5220603||Feb 25, 1992||Jun 15, 1993||International Computers Limited||Access control in a distributed computer system|
|US5263157||Feb 15, 1990||Nov 16, 1993||International Business Machines Corporation||Method and system for providing user access control within a distributed data processing system by the exchange of access control profiles|
|US5388255||Dec 19, 1991||Feb 7, 1995||Wang Laboratories, Inc.||System for updating local views from a global database using time stamps to determine when a change has occurred|
|US5420927||Feb 1, 1994||May 30, 1995||Micali; Silvio||Method for certifying public keys in a digital signature scheme|
|US5425102 *||Jun 9, 1994||Jun 13, 1995||Datasonix Corporation||Computer security apparatus with password hints|
|US5434918||Dec 14, 1993||Jul 18, 1995||Hughes Aircraft Company||Method for providing mutual authentication of a user and a server on a network|
|US5491752 *||Sep 2, 1994||Feb 13, 1996||Digital Equipment Corporation, Patent Law Group||System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens|
|US5495533||Apr 29, 1994||Feb 27, 1996||International Business Machines Corporation||Personal key archive|
|US5510777||Dec 28, 1993||Apr 23, 1996||At&T Corp.||Method for secure access control|
|US5544320||Jun 7, 1995||Aug 6, 1996||Konrad; Allan M.||Remote information service access system based on a client-server-service model|
|US5544322||May 9, 1994||Aug 6, 1996||International Business Machines Corporation||System and method for policy-based inter-realm authentication within a distributed processing system|
|US5572643||Oct 19, 1995||Nov 5, 1996||Judson; David H.||Web browser with dynamic display of information objects during linking|
|US5581749||Dec 21, 1992||Dec 3, 1996||Thedow Chemical Company||System and method for maintaining codes among distributed databases using a global database|
|US5588132||Oct 20, 1994||Dec 24, 1996||Digital Equipment Corporation||Method and apparatus for synchronizing data queues in asymmetric reflective memories|
|US5613012||May 17, 1995||Mar 18, 1997||Smarttouch, Llc.||Tokenless identification system for authorization of electronic transactions and electronic transmissions|
|US5623601||Nov 21, 1994||Apr 22, 1997||Milkway Networks Corporation||Apparatus and method for providing a secure gateway for communication and data exchanges between networks|
|US5627658||Dec 14, 1994||May 6, 1997||Xerox Corporation||Automatic networked facsimile queuing system|
|US5644354||Oct 9, 1992||Jul 1, 1997||Prevue Interactive, Inc.||Interactive video system|
|US5647002||Sep 1, 1995||Jul 8, 1997||Lucent Technologies Inc.||Synchronization of mailboxes of different types|
|US5657390||Aug 25, 1995||Aug 12, 1997||Netscape Communications Corporation||Secure socket layer application program apparatus and method|
|US5666530||Dec 2, 1992||Sep 9, 1997||Compaq Computer Corporation||System for automatic synchronization of common file between portable computer and host computer via communication channel selected from a plurality of usable channels there between|
|US5666553||Jul 22, 1994||Sep 9, 1997||Puma Technology, Inc.||Method for mapping, translating, and dynamically reconciling data between disparate computer platforms|
|US5675782||Jun 6, 1995||Oct 7, 1997||Microsoft Corporation||Controlling access to objects on multiple operating systems|
|US5682478||Jan 19, 1995||Oct 28, 1997||Microsoft Corporation||Method and apparatus for supporting multiple, simultaneous services over multiple, simultaneous connections between a client and network server|
|US5682524||May 26, 1995||Oct 28, 1997||Starfish Software, Inc.||Databank system with methods for efficiently storing non-uniform data records|
|US5684990||Jan 11, 1995||Nov 4, 1997||Puma Technology, Inc.||Synchronization of disparate databases|
|US5701423||Apr 7, 1994||Dec 23, 1997||Puma Technology, Inc.||Method for mapping, translating, and dynamically reconciling data between disparate computer platforms|
|US5706427||Jun 27, 1996||Jan 6, 1998||Cadix Inc.||Authentication method for networks|
|US5706502||Mar 25, 1996||Jan 6, 1998||Sun Microsystems, Inc.||Internet-enabled portfolio manager system and method|
|US5715403||Nov 23, 1994||Feb 3, 1998||Xerox Corporation||System for controlling the distribution and use of digital works having attached usage rights where the usage rights are defined by a usage rights grammar|
|US5721779||Aug 28, 1995||Feb 24, 1998||Funk Software, Inc.||Apparatus and methods for verifying the identity of a party|
|US5757916||Oct 6, 1995||May 26, 1998||International Series Research, Inc.||Method and apparatus for authenticating the location of remote users of networked computing systems|
|US5764902||Sep 29, 1995||Jun 9, 1998||Intel Corporation||Conditional insert or merge in a data conference|
|US5778346||May 17, 1996||Jul 7, 1998||Starfish Software, Inc.||System and methods for appointment reconcilation|
|US5784463||Dec 4, 1996||Jul 21, 1998||V-One Corporation||Token distribution, registration, and dynamic configuration of user entitlement for an application level security system and method|
|US5784464||Jan 31, 1996||Jul 21, 1998||Fujitsu Limited||System for and method of authenticating a client|
|US5787172||Feb 24, 1994||Jul 28, 1998||The Merdan Group, Inc.||Apparatus and method for establishing a cryptographic link between elements of a system|
|US5799086||Feb 19, 1997||Aug 25, 1998||Certco Llc||Enhanced cryptographic system and method with key escrow feature|
|US5812773||Jul 12, 1996||Sep 22, 1998||Microsoft Corporation||System and method for the distribution of hierarchically structured data|
|US5818935||Mar 10, 1997||Oct 6, 1998||Maa; Chia-Yiu||Internet enhanced video system|
|US5828840||Aug 6, 1996||Oct 27, 1998||Verifone, Inc.||Server for starting client application on client if client is network terminal and initiating client application on server if client is non network terminal|
|US5835601||Mar 15, 1995||Nov 10, 1998||Kabushiki Kaisha Toshiba||File editing system and shared file editing system with file content secrecy, file version management, and asynchronous editing|
|US5862346||Jun 28, 1996||Jan 19, 1999||Metadigm||Distributed group activity data network system and corresponding method|
|US5870544||Oct 20, 1997||Feb 9, 1999||International Business Machines Corporation||Method and apparatus for creating a secure connection between a java applet and a web server|
|US5924103||Mar 12, 1997||Jul 13, 1999||Hewlett-Packard Company||Works-in-progress in an information management system|
|US5943676||Nov 13, 1996||Aug 24, 1999||Puma Technology, Inc.||Synchronization of recurring records in incompatible databases|
|US5951652||Oct 6, 1997||Sep 14, 1999||Ncr Corporation||Dependable data element synchronization mechanism|
|US5974238||Aug 7, 1996||Oct 26, 1999||Compaq Computer Corporation||Automatic data synchronization between a handheld and a host computer using pseudo cache including tags and logical data elements|
|US5982898||Mar 7, 1997||Nov 9, 1999||At&T Corp.||Certification process|
|US5999947||May 27, 1997||Dec 7, 1999||Arkona, Llc||Distributing database differences corresponding to database change events made to a database table located on a server computer|
|US6020885||Jul 9, 1996||Feb 1, 2000||Sony Corporation||Three-dimensional virtual reality space sharing method and system using local and global object identification codes|
|US6154844 *||Dec 22, 1997||Nov 28, 2000||Finjan Software, Ltd.||System and method for attaching a downloadable security profile to a downloadable|
|US6212529||Mar 5, 1998||Apr 3, 2001||Puma Technology, Inc.||Synchronization of databases using filters|
|US6343313||Mar 25, 1997||Jan 29, 2002||Pixion, Inc.||Computer conferencing system with real-time multipoint, multi-speed, multi-stream scalability|
|US6360322 *||Sep 28, 1998||Mar 19, 2002||Symantec Corporation||Automatic recovery of forgotten passwords|
|US6470454 *||Mar 31, 1998||Oct 22, 2002||International Business Machines Corporation||Method and apparatus for establishing computer configuration protection passwords for protecting computer configurations|
|CA2191505A1||Nov 28, 1996||Jun 30, 1997||At & T Corp||Universal Connection Point for Resources and Communication|
|CA2210763A1||Jul 17, 1997||Jan 17, 1999||Ibm Canada||Key generation from a given string for entity authentication|
|EP0801478A2||Apr 7, 1997||Oct 15, 1997||International Business Machines Corporation||Cryptographic key recovery system|
|WO2001044916A2 *||Oct 12, 2000||Jun 21, 2001||Microsoft Corporation||Methods and arrangements for providing non-modal reminder information in a graphical user interface|
|WO2006123899A1 *||May 18, 2006||Nov 23, 2006||Solmaze Co., Ltd.||Method for operating and authenticating password system, and storage media having program source thereof|
|1||*||Abel, Amee, E-mail anywhere, May 1998, Time, pp. 1-4.|
|2||Adams, Charlotte; "Multilevel Secure Networking Charges Ahead"; Federal Computer Week; Apr. 12, 1993; 5 pages.|
|3||Article by Bellovin et al., entitled: "Network Firewalls" Published by IEEE Communications Magazine Sep. 1994, pp. 50-57.|
|4||Article by Braun et al., entitled: "Web Traffic Characterization: an assessment of the impact of caching documents from NCSA's web server" Published by Elsevier Science B.V. 1995 pp. 37-51.|
|5||Article by Greenwald et al., entitled: "Designing an Academic Firewall: Policy, Practice, and Experience with SURF" Published by IEEE Communications Magazine on Feb. 22, 1996, pp. 79-92.|
|6||Article by Kiuchi et et al., entitled: "C-HTTP-The Development of a Secure, Closed HTTP-based Network on the Internet" Published by IEEE Proceedings of SNDSS on Feb. 22, 1996, pp. 64-75.|
|7||Article by Nelson et al., entitled: "Security for Infinite Networks" Published by IEEE Communications Magazine on Aug. 22, 1995, pp. 11-19.|
|8||Article by S. Cobb, entitled: "Establishing Firewall Policy" Published by National Computer Security Assn. on Jun. 25-27, 1996, pp. 198-205.|
|9||Article by Steffen Stempel, entitled: "IPAccess-An Internet Service Access System for Firewall Installations" Published by IEEE Communications Magazine Feb. 16, 1995, pp. 31-41.|
|10||Freier et al., entitled "The SSL Protocol, Version 3.0," Netscape Communications, dated Nov. 18, 1996, pp. 1-59, Downloaded from URL=http://www.home.netscape.com/eng/ss13/draft302.txt.|
|11||Jaeger, Trent and Atul Prakash; "Implementation of a Discretionary Access Control Model for Script-based Systems"; IEEEE Jun. 1995; 15 pages.|
|12||Knudsen, Jonathan, "Java Cryptography", First Edition, O'Reilly & Assoc. 1998, ISBN 1-56592-402-9, pp. 79-91.|
|13||Kohl, John T., et al.; "The Evolution of the Kerberos Authentication Service"; 1991; pp. 1-15; This paper is a revision of a paper presented at the Spring 1991 EurOpen Conference in Tromso, Norway.|
|14||Mark R. Brown et al. "Using Netscape 2", Second Edition, QUE Corporation, 1995, Chapter 34 "SUN's JAVA and the Netscape Browser", pp. 885-907.|
|15||Tanenbaum, Andrew S., "Computer Network", Third Edition, Prentice-Hall 1996, ISBN 0-13-349945-6, Chapter 7, Sections 7.1.4 to 7.1.6, pp. 597-618.|
|16||US 5,373,559, 12/1994, Kaufman et al. (withdrawn)|
|17||Web page: www.verisign.com/press/product/isv.html, Verisign Press Release, "Verisign Enhances Digital IDS to Enable Universal Website Login and One-Step Registration", Nov. 3, 1998, 3 pages.|
|18||*||Young et al, Deniable Password Snatching: On the Possibility of Evasive Electronic Espionage, 1997, IEEE, pp. 224-235.|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7681007||Mar 16, 2010||Broadcom Corporation||Automatic expansion of hard disk drive capacity in a storage device|
|US7681030 *||Feb 7, 2003||Mar 16, 2010||Ntt Docomo, Inc.||Mobile communication terminal, information processing method, data processing program, and recording medium|
|US7813512 *||Oct 18, 2004||Oct 12, 2010||Panasonic Corporation||Encrypted communication system and communication device|
|US8191159 *||Sep 10, 2009||May 29, 2012||Micron Technology, Inc||Data security for digital data storage|
|US8307217 *||Nov 6, 2012||Lee Lane W||Trusted storage|
|US8402039 *||Feb 12, 2010||Mar 19, 2013||Brother Kogyo Kabushiki Kaisha||Information processing apparatus and computer readable medium having information processing program|
|US8402522 *||Mar 19, 2013||Morgan Stanley||System and method for managing services and jobs running under production IDs without exposing passwords for the production IDs to humans|
|US8407305||Nov 21, 2011||Mar 26, 2013||Research In Motion Limited||System and method for pushing information from a mobile computer to another device|
|US8447990 *||Oct 23, 2003||May 21, 2013||Cambridge Interactive Development Corp.||Password encryption key|
|US8467533 *||Jun 18, 2013||Wolfgang Hammersmith||One-time-pad encryption with key ID and offset for starting point|
|US8549314||Apr 29, 2010||Oct 1, 2013||King Saud University||Password generation methods and systems|
|US8601263 *||May 18, 2011||Dec 3, 2013||Google Inc.||Storing encrypted objects|
|US8601600||May 18, 2011||Dec 3, 2013||Google Inc.||Storing encrypted objects|
|US8607358||May 18, 2011||Dec 10, 2013||Google Inc.||Storing encrypted objects|
|US8650657||May 18, 2011||Feb 11, 2014||Google Inc.||Storing encrypted objects|
|US8713646||Dec 9, 2011||Apr 29, 2014||Erich Stuntebeck||Controlling access to resources on a network|
|US8756426||Jul 3, 2013||Jun 17, 2014||Sky Socket, Llc||Functionality watermarking and management|
|US8775815||Jul 3, 2013||Jul 8, 2014||Sky Socket, Llc||Enterprise-specific functionality watermarking and management|
|US8799643 *||Sep 14, 2012||Aug 5, 2014||The Nielsen Company (Us), Llc||System and method for monitoring secure data on a network|
|US8806217||Aug 6, 2013||Aug 12, 2014||Sky Socket, Llc||Functionality watermarking and management|
|US8826432||Dec 21, 2012||Sep 2, 2014||Airwatch, Llc||Systems and methods for controlling email access|
|US8832785||Jan 14, 2013||Sep 9, 2014||Airwatch, Llc||Systems and methods for controlling email access|
|US8862868||Dec 6, 2012||Oct 14, 2014||Airwatch, Llc||Systems and methods for controlling email access|
|US8898482 *||Feb 22, 2011||Nov 25, 2014||Lockify, Inc.||Encryption system using clients and untrusted servers|
|US8914013||Apr 25, 2013||Dec 16, 2014||Airwatch Llc||Device management macros|
|US8924608||Jun 25, 2013||Dec 30, 2014||Airwatch Llc||Peripheral device management|
|US8978110||Dec 6, 2012||Mar 10, 2015||Airwatch Llc||Systems and methods for controlling email access|
|US8997187||Mar 15, 2013||Mar 31, 2015||Airwatch Llc||Delegating authorization to applications on a client device in a networked environment|
|US9003177 *||May 25, 2012||Apr 7, 2015||Micron Technology, Inc.||Data security for digital data storage|
|US9021037||Jan 25, 2013||Apr 28, 2015||Airwatch Llc||Systems and methods for controlling email access|
|US9058495||May 16, 2013||Jun 16, 2015||Airwatch Llc||Rights management services integration with mobile device management|
|US9123031||Apr 26, 2013||Sep 1, 2015||Airwatch Llc||Attendance tracking via device presence|
|US9148283 *||Oct 30, 2013||Sep 29, 2015||Google Inc.||Storing encrypted objects|
|US9148416||Mar 15, 2013||Sep 29, 2015||Airwatch Llc||Controlling physical access to secure areas via client devices in a networked environment|
|US9185107 *||Jan 22, 2014||Nov 10, 2015||Red Hat, Inc.||Securing passwords with hash value|
|US9195811||Dec 27, 2013||Nov 24, 2015||Airwatch Llc||Functionality watermarking and management|
|US9202025||Feb 17, 2014||Dec 1, 2015||Airwatch Llc||Enterprise-specific functionality watermarking and management|
|US9203820||Mar 15, 2013||Dec 1, 2015||Airwatch Llc||Application program as key for authorizing access to resources|
|US9219741||May 2, 2013||Dec 22, 2015||Airwatch, Llc||Time-based configuration policy toggling|
|US9246918||May 10, 2013||Jan 26, 2016||Airwatch Llc||Secure application leveraging of web filter proxy services|
|US9247432||Oct 19, 2012||Jan 26, 2016||Airwatch Llc||Systems and methods for controlling network access|
|US9258301||Dec 2, 2013||Feb 9, 2016||Airwatch Llc||Advanced authentication techniques|
|US9270777||Jun 6, 2013||Feb 23, 2016||Airwatch Llc||Social media and data sharing controls for data security purposes|
|US9275245||Mar 15, 2013||Mar 1, 2016||Airwatch Llc||Data access sharing|
|US9292674||May 17, 2013||Mar 22, 2016||Cambridge Interactive Development Corp.||Password encryption key|
|US9313181||Feb 28, 2014||Apr 12, 2016||Raytheon Bbn Technologies Corp.||System and method to merge encrypted signals in distributed communication system|
|US9325671||Feb 19, 2014||Apr 26, 2016||Raytheon Bbn Technologies Corp.||System and method for merging encryption data using circular encryption key switching|
|US9325713||May 7, 2014||Apr 26, 2016||Airwatch Llc||Systems and methods for controlling email access|
|US20030026429 *||Sep 24, 2002||Feb 6, 2003||Vadium Technology, Inc.||One-time-pad encryption with key ID and offset for starting point|
|US20040171399 *||Feb 7, 2003||Sep 2, 2004||Motoyuki Uchida||Mobile communication terminal, information processing method, data processing program, and recording medium|
|US20050231849 *||Apr 8, 2005||Oct 20, 2005||Viresh Rustagi||Graphical user interface for hard disk drive management in a data storage system|
|US20050235063 *||Apr 15, 2005||Oct 20, 2005||Wilson Christopher S||Automatic discovery of a networked device|
|US20050235128 *||Apr 15, 2005||Oct 20, 2005||Viresh Rustagi||Automatic expansion of hard disk drive capacity in a storage device|
|US20050235283 *||Apr 15, 2005||Oct 20, 2005||Wilson Christopher S||Automatic setup of parameters in networked devices|
|US20050235364 *||Apr 8, 2005||Oct 20, 2005||Wilson Christopher S||Authentication mechanism permitting access to data stored in a data processing device|
|US20050259458 *||Mar 22, 2005||Nov 24, 2005||Viresh Rustagi||Method and system of encrypting/decrypting data stored in one or more storage devices|
|US20060034456 *||Apr 18, 2005||Feb 16, 2006||Secure Choice Llc||Method and system for performing perfectly secure key exchange and authenticated messaging|
|US20060156026 *||Oct 23, 2003||Jul 13, 2006||Daniil Utin||Password encryption key|
|US20060236406 *||Jun 16, 2006||Oct 19, 2006||Johnson R B||System and computer based method to automatically archive and retrieve encrypted remote client data files|
|US20070150735 *||Oct 18, 2004||Jun 28, 2007||Yuichi Futa||Encrypted communication system and communication device|
|US20070250550 *||Apr 20, 2007||Oct 25, 2007||Joern Berninger||Systems and methods of providing versioned user information to an entity|
|US20080294914 *||Feb 5, 2008||Nov 27, 2008||Lee Lane W||Trusted storage|
|US20100005287 *||Jan 7, 2010||Micron Technology, Inc.||Data security for digital data storage|
|US20100205188 *||Aug 12, 2010||Brother Kogyo Kabushiki Kaisha||Information processing apparatus and computer readable medium having information processing program|
|US20110296179 *||Dec 1, 2011||Christopher Templin||Encryption System using Web Browsers and Untrusted Web Servers|
|US20120233454 *||May 25, 2012||Sep 13, 2012||Rollins Doug L||Data security for digital data storage|
|US20130013914 *||Sep 14, 2012||Jan 10, 2013||Todd Tao Zhou||System and Method for Monitoring Secure Data on a Network|
|US20130198521 *||Jan 28, 2012||Aug 1, 2013||Jianqing Wu||Secure File Drawer and Safe|
|US20140137224 *||Jan 22, 2014||May 15, 2014||Red Hat, Inc.||Securing passwords with hash value|
|US20150207783 *||Nov 24, 2014||Jul 23, 2015||Lockify, Inc.||Encryption system using web browsers and untrusted web servers|
|US20150249650 *||Feb 28, 2014||Sep 3, 2015||Raytheon Bbn Technologies Corp.||System and method to merge encrypted signals in distributed communication system|
|WO2014172593A1 *||Apr 18, 2014||Oct 23, 2014||RISOFTDEV, Inc.||System and methods for encrypting data|
|U.S. Classification||713/184, 380/44, 713/168, 726/5, 713/193, 713/183|
|International Classification||H04L9/08, H04L9/00, H04L9/32, G06F12/14, H04L29/06|
|Cooperative Classification||H04L2463/041, H04L63/083, H04L63/0435, H04L63/06, H04L2209/38, H04L9/0863|
|European Classification||H04L63/04B1, H04L63/06, H04L9/08H2, H04L63/08D|
|Aug 19, 1999||AS||Assignment|
Owner name: VISTO CORPORATION, CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:RIGGINS, MARK D.;REEL/FRAME:010191/0758
Effective date: 19990701
|Aug 20, 1999||AS||Assignment|
Owner name: IGIA DIRECT, INC., NEW YORK
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:RAMCHANDANI, PREM A.;REEL/FRAME:010195/0492
Effective date: 19990817
|Aug 9, 2000||AS||Assignment|
Owner name: SAND HILL CAPITAL II, LP, CALIFORNIA
Free format text: SECURITY INTEREST;ASSIGNOR:VISTO CORPORATION;REEL/FRAME:011052/0664
Effective date: 20000803
Owner name: SAND HILL CAPITAL II, LP,CALIFORNIA
Free format text: SECURITY INTEREST;ASSIGNOR:VISTO CORPORATION;REEL/FRAME:011052/0664
Effective date: 20000803
|Apr 30, 2001||AS||Assignment|
Owner name: FB COMMERCIAL FINANCE, INC., MISSOURI
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SAND HILL CAPITAL II, L.P.;SAND HILL CAPITAL II Q, L.P.;SAND HILL CAPITAL, LLC;REEL/FRAME:011742/0974
Effective date: 20001211
Owner name: FB COMMERCIAL FINANCE, INC.,MISSOURI
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SAND HILL CAPITAL II, L.P.;SAND HILL CAPITAL II Q, L.P.;SAND HILL CAPITAL, LLC;REEL/FRAME:011742/0974
Effective date: 20001211
|Jul 31, 2003||AS||Assignment|
Owner name: VISTO CORPORATION, CALIFORNIA
Free format text: CHANGE OF CONVEYING PARTY S ADDRESS;ASSIGNOR:VISTO CORPORATION;REEL/FRAME:014330/0230
Effective date: 20030728
|Nov 10, 2011||FPAY||Fee payment|
Year of fee payment: 4
|Nov 26, 2012||AS||Assignment|
Owner name: GOOD TECHNOLOGY CORPORATION, DELAWARE
Free format text: CHANGE OF NAME;ASSIGNOR:VISTO CORPORATION;REEL/FRAME:029347/0783
Effective date: 20120919
|Mar 7, 2014||AS||Assignment|
Owner name: GOOD TECHNOLOGY CORPORATION, CALIFORNIA
Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:FB COMMERCIAL FINANCE, INC.;REEL/FRAME:032384/0001
Effective date: 20140117
|Nov 11, 2015||FPAY||Fee payment|
Year of fee payment: 8